VarParseNumFromStrcomodo
comodo 时间:2021-01-12 阅读:()
SummaryFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecMALWAREValkyrieFinalVerdictDETECTIONSECTIONSeverity:HighVerdict:MalwareCLASSIFICATION49%39%29%20%10%Backdoor(5.
71%)Bot(31.
33%)Exploit(0.
00%)Pua(0.
29%)TrojanGeneric(48.
76%)TrojanDownloader(0.
76%)TrojanDropper(1.
71%)Rogue(0.
10%)Virus(0.
00%)RemoteAccessTrojan(0.
00%)Spyware(0.
00%)Rootkit(0.
00%)TrojanPasswordStealer(6.
67%)Worm(4.
67%)Ransomware(0.
00%)HIGHLEVELBEHAVIORDISTRIBUTION47.
0%35.
3%6.
4%Windows(5)Misc(7)System(117)Crypto(1)Process(8)Synchronization(5)Registry(88)FileSystem(16)Device(2)ACTIVITYOVERVIEWPacker1(100.
00%)Page1ActivityDetailsPACKERThebinarylikelycontainsencryptedorcompresseddata.
ShowsourcesPage2BehaviorGraph14:45:2214:45:2214:45:22PID2784Themaliciousfilecreatedachildprocessas191abc2025695b1cbe6577c191d55adf3662d0f1.
exe(PPID2760)14:45:22CreateProcessPage3BehaviorSummaryACCESSEDFILESREADREGISTRYKEYS\Device\KsecDDC:\Users\user\AppData\Local\Temp\191abc2025695b1cbe6577c191d55adf3662d0f1.
exe.
cfgC:\Windows\sysnative\C_932.
NLSC:\Windows\sysnative\C_949.
NLSC:\Windows\sysnative\C_950.
NLSC:\Windows\sysnative\C_936.
NLSC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15Page4RESOLVEDAPISHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enablecryptbase.
dll.
SystemFunction036uxtheme.
dll.
ThemeInitApiHookuser32.
dll.
IsProcessDPIAwareoleaut32.
dll.
OleLoadPictureExoleaut32.
dll.
DispCallFuncoleaut32.
dll.
LoadTypeLibExoleaut32.
dll.
UnRegisterTypeLiboleaut32.
dll.
CreateTypeLib2oleaut32.
dll.
VarDateFromUdateoleaut32.
dll.
VarUdateFromDateoleaut32.
dll.
GetAltMonthNamesoleaut32.
dll.
VarNumFromParseNumoleaut32.
dll.
VarParseNumFromStroleaut32.
dll.
VarDecFromR4oleaut32.
dll.
VarDecFromR8oleaut32.
dll.
VarDecFromDateoleaut32.
dll.
VarDecFromI4oleaut32.
dll.
VarDecFromCyoleaut32.
dll.
VarR4FromDecoleaut32.
dll.
GetRecordInfoFromTypeInfooleaut32.
dll.
GetRecordInfoFromGuidsoleaut32.
dll.
SafeArrayGetRecordInfooleaut32.
dll.
SafeArraySetRecordInfooleaut32.
dll.
SafeArrayGetIIDoleaut32.
dll.
SafeArraySetIIDoleaut32.
dll.
SafeArrayCopyDataoleaut32.
dll.
SafeArrayAllocDescriptorExoleaut32.
dll.
SafeArrayCreateExoleaut32.
dll.
VarFormatoleaut32.
dll.
VarFormatDateTimeoleaut32.
dll.
VarFormatNumberPage5oleaut32.
dll.
VarFormatPercentoleaut32.
dll.
VarFormatCurrencyoleaut32.
dll.
VarWeekdayNameoleaut32.
dll.
VarMonthNameoleaut32.
dll.
VarAddoleaut32.
dll.
VarAndoleaut32.
dll.
VarCatoleaut32.
dll.
VarDivoleaut32.
dll.
VarEqvoleaut32.
dll.
VarIdivoleaut32.
dll.
VarImpoleaut32.
dll.
VarModoleaut32.
dll.
VarMuloleaut32.
dll.
VarOroleaut32.
dll.
VarPowoleaut32.
dll.
VarSuboleaut32.
dll.
VarXoroleaut32.
dll.
VarAbsoleaut32.
dll.
VarFixoleaut32.
dll.
VarIntoleaut32.
dll.
VarNegoleaut32.
dll.
VarNotoleaut32.
dll.
VarRoundoleaut32.
dll.
VarCmpoleaut32.
dll.
VarDecAddoleaut32.
dll.
VarDecCmpoleaut32.
dll.
VarBstrCatoleaut32.
dll.
VarCyMulI4oleaut32.
dll.
VarBstrCmpole32.
dll.
CoCreateInstanceExole32.
dll.
CLSIDFromProgIDExsxs.
dll.
SxsOleAut32MapIIDOrCLSIDToTypeLibraryuser32.
dll.
GetSystemMetricsuser32.
dll.
MonitorFromWindowuser32.
dll.
MonitorFromRectPage6REGISTRYKEYSuser32.
dll.
MonitorFromPointuser32.
dll.
EnumDisplayMonitorsuser32.
dll.
GetMonitorInfoAcryptsp.
dll.
CryptAcquireContextWcryptsp.
dll.
CryptGenRandomdwmapi.
dll.
DwmIsCompositionEnabledgdi32.
dll.
GetLayoutgdi32.
dll.
GdiRealizationInfogdi32.
dll.
FontIsLinkedadvapi32.
dll.
RegOpenKeyExWHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\WindowsErrorReporting\WMRHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodepageHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\MonitorsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\FontLink\SystemLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallbackHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9Page7READFILESHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\SegoeUIHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\191abc2025695b1cbe6577c191d55adf3662d0f1.
exeHKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable\Device\KsecDDC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datPage8NetworkBehaviorCONTACTEDIPSNETWORKPORTDISTRIBUTION16.
7%50.
0%16.
7%16.
7%3702(UDP)16.
67%5355(UDP)50%138(UDP)16.
67%137(UDP)16.
67%NameIPCountryASNASNNameTriggerProcessTypeUDPPACKETSCallTimeDuringExecution(sec)SourceIPDestIPDestPort7.
1813480854Sandbox224.
0.
0.
25253557.
199187994Sandbox224.
0.
0.
25253557.
20554494858Sandbox239.
255.
255.
25037027.
25436401367Sandbox192.
168.
56.
2551379.
86339116096Sandbox224.
0.
0.
252535513.
3003180027Sandbox192.
168.
56.
255138Page9DETAILEDFILEINFOCREATED/DROPPEDFILESFILEPATHTYPEANDHASHESC:\Users\User\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPType:CompositeDocumentFileV2Document,NosummaryinfoMD5:c3d77de3d723019d7706372c03ecd64fSHA-1:26664978545d2c4b9965d9f0e0e83630be5cb60bSHA-256:4e8d510c9910d1b78b9aa71a8edd85a92e0e402a…SHA-512:d92c8593a5f0286b47ba1faa98515433418e9ce55…Size:16.
384Kilobytes.
MATCHYARARULESMATCHRULESSTATICFILEINFOFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecFirstSeenDate:2018-01-2623:46:18.
635898(aboutayearago)NumberOfClientsSeen:5LastAnalysisDate:2018-01-2623:46:18.
635898(aboutayearago)HumanExpertAnalysisResult:Nohumanexpertanalysisverdictgiventothissampleyet.
Page10DETAILEDFILEINFOADDITIONALFILEINFORMATIONPEHeadersPage11PROPERTYVALUEMagicLiteralEnum3FileTypeEnum6DebugArtifacts[]NumberOfSections3Trid[[84.
4,u'Win32ExecutableMicrosoftVisualBasic6'],[6.
7,u'Win32DynamicLinkLibrary(generic)'],[4.
6,u'Win32Executable(generic)'],[2.
0,u'GenericWin/DOSExecutable'],[2.
0,u'DOSExecutableGeneric']]CompilationTimeStamp0x5A691C22[WedJan2423:52:022018UTC]Translation0x00000x04b0LegalCopyrightFacebookInc.
InternalNameBerdache7FileVersion1.
00CompanyNameTheUPXTeamhttp://upx.
sf.
netLegalTrademarksAVASTSoftwareCommentsIntelProductNameXamasoftProductVersion1.
00FileDescriptionSourcefire,Inc.
OriginalFilenameBerdache7.
exeEntryPoint0x4011bc(.
text)MachineTypeIntel386orlater-32BitFileSize303104Ssdeep3072:zVLrYTTY6ZSwUbp4wy4lI/JcXCNxWH+hp4lRJDOQ+4XmgvbipThWcwv9k0QvA8MU:JoTmwGp4woB7N+uQQyripTVM2Y8McSha2560139454fb4515eb810075d84857d7018cad6abd328df82afdc506f8a59fd2eb2Exifinfo[{u'EXE:FileSubtype':0,u'File:FilePermissions':u'rw-r--r--',u'SourceFile':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a/191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:OriginalFileName':u'Berdache7.
exe',u'EXE:ProductName':u'Xamasoft',u'EXE:InternalName':u'Berdache7',u'File:MIMEType':u'application/octet-stream',u'File:FileAccessDate':u'2018:01:2623:45:59+00:00',u'EXE:InitializedDataSize':28672,u'File:FileModifyDate':u'2018:01:2623:45:58+00:00',u'EXE:FileVersionNumber':u'1.
0.
0.
0',u'EXE:FileVersion':1.
0,u'File:FileSize':u'296kB',u'EXE:CharacterSet':u'Unicode',u'EXE:MachineType':u'Intel386orlater,andcompatibles',u'EXE:FileOS':u'Win32',u'EXE:LegalTrademarks':u'AVASTSoftware',u'EXE:ProductVersion':1.
0,u'EXE:ObjectFileType':u'Executableapplication',u'File:FileType':u'Win32EXE',u'EXE:CompanyName':u'TheUPXTeamhttp://upx.
sf.
net',u'File:FileName':u'191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:ImageVersion':1.
0,u'File:FileTypeExtension':u'exe',u'EXE:OSVersion':4.
0,u'EXE:PEType':u'PE32',u'EXE:TimeStamp':u'2018:01:2423:52:02+00:00',u'EXE:FileFlagsMask':u'0x0000',u'EXE:LegalCopyright':u'FacebookInc.
',u'EXE:LinkerVersion':6.
0,u'EXE:FileFlags':u'(none)',u'EXE:Subsystem':u'WindowsGUI',u'File:Directory':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a',u'EXE:FileDescription':u'Sourcefire,Inc.
',u'EXE:EntryPoint':u'0x11bc',u'EXE:SubsystemVersion':4.
0,u'EXE:CodeSize':290816,u'EXE:Comments':u'Intel',u'File:FileInodeChangeDate':u'2018:01:2623:45:59+00:00',u'EXE:UninitializedDataSize':0,u'EXE:LanguageCode':u'Neutral',u'ExifTool:ExifToolVersion':10.
1,u'EXE:ProductVersionNumber':u'1.
0.
0.
0'}]MimeTypeapplication/x-dosexecImphasha9fa280944d9180b2e5bfebfa98e4a15PESectionsPage12NAMEVIRTUALADDRESSVIRTUALSIZERAWSIZEENTROPYMD5.
text0x10000x46df80x470007.
7902237762830a720db1fa39c39fe3baa9d1891d853.
data0x480000x5c1c0x10000.
0620f0b67a91f7f74151bc5be745b7110.
rsrc0x4e0000xe660x10004.
30475677175af539bded62ffaf31f36ca3cc8805c4aPEImportsMSVBVM60.
DLL_CIcos_adj_fptan__vbaFreeVar_adj_fdiv_m64_adj_fprem1None__vbaSetSystemError__vbaHresultCheckObj_adj_fdiv_m32_adj_fdiv_m16i_adj_fdivr_m16i_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaStrCmp__vbaCyI4DllFunctionCall_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler_adj_fprem_adj_fdivr_m64__vbaFPException_CIlog__vbaErrorOverflow__vbaNew2_adj_fdiv_m32i_adj_fdivr_m32i__vbaFreeStrList_adj_fdivr_m32_adj_fdiv_rNone_CIatan__vbaI4Cy_allmul_CItan_CIexpPEResources{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':321790,u'sha256':u'99663efee2758204e3cd58f3cbeb62c92b913abdc6656987467e2ea976fbed71',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1384}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':320662,u'sha256':u'a2631dedf7188fbf5640b36941d788d3fdbbb5996244b4891eb6c7313ea2596f',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1128}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_GROUP_ICON',u'offset':320628,u'sha256':u'6369848d3ee42be4460e6f4b9c8b003e2640e7e262220182de7d8f8c64cec290',u'type':u'MSWindowsiconresource-2icons,16x16',u'size':34}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_VERSION',u'offset':319776,u'sha256':u'80ff935a732d6447380ade43d114e62bf37b8cf8f0f192f0dd21bb55a372ed07',u'type':u'data',u'size':852}CERTIFICATEVALIDATION-CertificateValidationisnotApplicablePage13SCREENSHOTSPage14
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecMALWAREValkyrieFinalVerdictDETECTIONSECTIONSeverity:HighVerdict:MalwareCLASSIFICATION49%39%29%20%10%Backdoor(5.
71%)Bot(31.
33%)Exploit(0.
00%)Pua(0.
29%)TrojanGeneric(48.
76%)TrojanDownloader(0.
76%)TrojanDropper(1.
71%)Rogue(0.
10%)Virus(0.
00%)RemoteAccessTrojan(0.
00%)Spyware(0.
00%)Rootkit(0.
00%)TrojanPasswordStealer(6.
67%)Worm(4.
67%)Ransomware(0.
00%)HIGHLEVELBEHAVIORDISTRIBUTION47.
0%35.
3%6.
4%Windows(5)Misc(7)System(117)Crypto(1)Process(8)Synchronization(5)Registry(88)FileSystem(16)Device(2)ACTIVITYOVERVIEWPacker1(100.
00%)Page1ActivityDetailsPACKERThebinarylikelycontainsencryptedorcompresseddata.
ShowsourcesPage2BehaviorGraph14:45:2214:45:2214:45:22PID2784Themaliciousfilecreatedachildprocessas191abc2025695b1cbe6577c191d55adf3662d0f1.
exe(PPID2760)14:45:22CreateProcessPage3BehaviorSummaryACCESSEDFILESREADREGISTRYKEYS\Device\KsecDDC:\Users\user\AppData\Local\Temp\191abc2025695b1cbe6577c191d55adf3662d0f1.
exe.
cfgC:\Windows\sysnative\C_932.
NLSC:\Windows\sysnative\C_949.
NLSC:\Windows\sysnative\C_950.
NLSC:\Windows\sysnative\C_936.
NLSC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15Page4RESOLVEDAPISHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enablecryptbase.
dll.
SystemFunction036uxtheme.
dll.
ThemeInitApiHookuser32.
dll.
IsProcessDPIAwareoleaut32.
dll.
OleLoadPictureExoleaut32.
dll.
DispCallFuncoleaut32.
dll.
LoadTypeLibExoleaut32.
dll.
UnRegisterTypeLiboleaut32.
dll.
CreateTypeLib2oleaut32.
dll.
VarDateFromUdateoleaut32.
dll.
VarUdateFromDateoleaut32.
dll.
GetAltMonthNamesoleaut32.
dll.
VarNumFromParseNumoleaut32.
dll.
VarParseNumFromStroleaut32.
dll.
VarDecFromR4oleaut32.
dll.
VarDecFromR8oleaut32.
dll.
VarDecFromDateoleaut32.
dll.
VarDecFromI4oleaut32.
dll.
VarDecFromCyoleaut32.
dll.
VarR4FromDecoleaut32.
dll.
GetRecordInfoFromTypeInfooleaut32.
dll.
GetRecordInfoFromGuidsoleaut32.
dll.
SafeArrayGetRecordInfooleaut32.
dll.
SafeArraySetRecordInfooleaut32.
dll.
SafeArrayGetIIDoleaut32.
dll.
SafeArraySetIIDoleaut32.
dll.
SafeArrayCopyDataoleaut32.
dll.
SafeArrayAllocDescriptorExoleaut32.
dll.
SafeArrayCreateExoleaut32.
dll.
VarFormatoleaut32.
dll.
VarFormatDateTimeoleaut32.
dll.
VarFormatNumberPage5oleaut32.
dll.
VarFormatPercentoleaut32.
dll.
VarFormatCurrencyoleaut32.
dll.
VarWeekdayNameoleaut32.
dll.
VarMonthNameoleaut32.
dll.
VarAddoleaut32.
dll.
VarAndoleaut32.
dll.
VarCatoleaut32.
dll.
VarDivoleaut32.
dll.
VarEqvoleaut32.
dll.
VarIdivoleaut32.
dll.
VarImpoleaut32.
dll.
VarModoleaut32.
dll.
VarMuloleaut32.
dll.
VarOroleaut32.
dll.
VarPowoleaut32.
dll.
VarSuboleaut32.
dll.
VarXoroleaut32.
dll.
VarAbsoleaut32.
dll.
VarFixoleaut32.
dll.
VarIntoleaut32.
dll.
VarNegoleaut32.
dll.
VarNotoleaut32.
dll.
VarRoundoleaut32.
dll.
VarCmpoleaut32.
dll.
VarDecAddoleaut32.
dll.
VarDecCmpoleaut32.
dll.
VarBstrCatoleaut32.
dll.
VarCyMulI4oleaut32.
dll.
VarBstrCmpole32.
dll.
CoCreateInstanceExole32.
dll.
CLSIDFromProgIDExsxs.
dll.
SxsOleAut32MapIIDOrCLSIDToTypeLibraryuser32.
dll.
GetSystemMetricsuser32.
dll.
MonitorFromWindowuser32.
dll.
MonitorFromRectPage6REGISTRYKEYSuser32.
dll.
MonitorFromPointuser32.
dll.
EnumDisplayMonitorsuser32.
dll.
GetMonitorInfoAcryptsp.
dll.
CryptAcquireContextWcryptsp.
dll.
CryptGenRandomdwmapi.
dll.
DwmIsCompositionEnabledgdi32.
dll.
GetLayoutgdi32.
dll.
GdiRealizationInfogdi32.
dll.
FontIsLinkedadvapi32.
dll.
RegOpenKeyExWHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\WindowsErrorReporting\WMRHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodepageHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\MonitorsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\FontLink\SystemLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallbackHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9Page7READFILESHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\SegoeUIHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\191abc2025695b1cbe6577c191d55adf3662d0f1.
exeHKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable\Device\KsecDDC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datPage8NetworkBehaviorCONTACTEDIPSNETWORKPORTDISTRIBUTION16.
7%50.
0%16.
7%16.
7%3702(UDP)16.
67%5355(UDP)50%138(UDP)16.
67%137(UDP)16.
67%NameIPCountryASNASNNameTriggerProcessTypeUDPPACKETSCallTimeDuringExecution(sec)SourceIPDestIPDestPort7.
1813480854Sandbox224.
0.
0.
25253557.
199187994Sandbox224.
0.
0.
25253557.
20554494858Sandbox239.
255.
255.
25037027.
25436401367Sandbox192.
168.
56.
2551379.
86339116096Sandbox224.
0.
0.
252535513.
3003180027Sandbox192.
168.
56.
255138Page9DETAILEDFILEINFOCREATED/DROPPEDFILESFILEPATHTYPEANDHASHESC:\Users\User\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPType:CompositeDocumentFileV2Document,NosummaryinfoMD5:c3d77de3d723019d7706372c03ecd64fSHA-1:26664978545d2c4b9965d9f0e0e83630be5cb60bSHA-256:4e8d510c9910d1b78b9aa71a8edd85a92e0e402a…SHA-512:d92c8593a5f0286b47ba1faa98515433418e9ce55…Size:16.
384Kilobytes.
MATCHYARARULESMATCHRULESSTATICFILEINFOFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecFirstSeenDate:2018-01-2623:46:18.
635898(aboutayearago)NumberOfClientsSeen:5LastAnalysisDate:2018-01-2623:46:18.
635898(aboutayearago)HumanExpertAnalysisResult:Nohumanexpertanalysisverdictgiventothissampleyet.
Page10DETAILEDFILEINFOADDITIONALFILEINFORMATIONPEHeadersPage11PROPERTYVALUEMagicLiteralEnum3FileTypeEnum6DebugArtifacts[]NumberOfSections3Trid[[84.
4,u'Win32ExecutableMicrosoftVisualBasic6'],[6.
7,u'Win32DynamicLinkLibrary(generic)'],[4.
6,u'Win32Executable(generic)'],[2.
0,u'GenericWin/DOSExecutable'],[2.
0,u'DOSExecutableGeneric']]CompilationTimeStamp0x5A691C22[WedJan2423:52:022018UTC]Translation0x00000x04b0LegalCopyrightFacebookInc.
InternalNameBerdache7FileVersion1.
00CompanyNameTheUPXTeamhttp://upx.
sf.
netLegalTrademarksAVASTSoftwareCommentsIntelProductNameXamasoftProductVersion1.
00FileDescriptionSourcefire,Inc.
OriginalFilenameBerdache7.
exeEntryPoint0x4011bc(.
text)MachineTypeIntel386orlater-32BitFileSize303104Ssdeep3072:zVLrYTTY6ZSwUbp4wy4lI/JcXCNxWH+hp4lRJDOQ+4XmgvbipThWcwv9k0QvA8MU:JoTmwGp4woB7N+uQQyripTVM2Y8McSha2560139454fb4515eb810075d84857d7018cad6abd328df82afdc506f8a59fd2eb2Exifinfo[{u'EXE:FileSubtype':0,u'File:FilePermissions':u'rw-r--r--',u'SourceFile':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a/191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:OriginalFileName':u'Berdache7.
exe',u'EXE:ProductName':u'Xamasoft',u'EXE:InternalName':u'Berdache7',u'File:MIMEType':u'application/octet-stream',u'File:FileAccessDate':u'2018:01:2623:45:59+00:00',u'EXE:InitializedDataSize':28672,u'File:FileModifyDate':u'2018:01:2623:45:58+00:00',u'EXE:FileVersionNumber':u'1.
0.
0.
0',u'EXE:FileVersion':1.
0,u'File:FileSize':u'296kB',u'EXE:CharacterSet':u'Unicode',u'EXE:MachineType':u'Intel386orlater,andcompatibles',u'EXE:FileOS':u'Win32',u'EXE:LegalTrademarks':u'AVASTSoftware',u'EXE:ProductVersion':1.
0,u'EXE:ObjectFileType':u'Executableapplication',u'File:FileType':u'Win32EXE',u'EXE:CompanyName':u'TheUPXTeamhttp://upx.
sf.
net',u'File:FileName':u'191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:ImageVersion':1.
0,u'File:FileTypeExtension':u'exe',u'EXE:OSVersion':4.
0,u'EXE:PEType':u'PE32',u'EXE:TimeStamp':u'2018:01:2423:52:02+00:00',u'EXE:FileFlagsMask':u'0x0000',u'EXE:LegalCopyright':u'FacebookInc.
',u'EXE:LinkerVersion':6.
0,u'EXE:FileFlags':u'(none)',u'EXE:Subsystem':u'WindowsGUI',u'File:Directory':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a',u'EXE:FileDescription':u'Sourcefire,Inc.
',u'EXE:EntryPoint':u'0x11bc',u'EXE:SubsystemVersion':4.
0,u'EXE:CodeSize':290816,u'EXE:Comments':u'Intel',u'File:FileInodeChangeDate':u'2018:01:2623:45:59+00:00',u'EXE:UninitializedDataSize':0,u'EXE:LanguageCode':u'Neutral',u'ExifTool:ExifToolVersion':10.
1,u'EXE:ProductVersionNumber':u'1.
0.
0.
0'}]MimeTypeapplication/x-dosexecImphasha9fa280944d9180b2e5bfebfa98e4a15PESectionsPage12NAMEVIRTUALADDRESSVIRTUALSIZERAWSIZEENTROPYMD5.
text0x10000x46df80x470007.
7902237762830a720db1fa39c39fe3baa9d1891d853.
data0x480000x5c1c0x10000.
0620f0b67a91f7f74151bc5be745b7110.
rsrc0x4e0000xe660x10004.
30475677175af539bded62ffaf31f36ca3cc8805c4aPEImportsMSVBVM60.
DLL_CIcos_adj_fptan__vbaFreeVar_adj_fdiv_m64_adj_fprem1None__vbaSetSystemError__vbaHresultCheckObj_adj_fdiv_m32_adj_fdiv_m16i_adj_fdivr_m16i_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaStrCmp__vbaCyI4DllFunctionCall_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler_adj_fprem_adj_fdivr_m64__vbaFPException_CIlog__vbaErrorOverflow__vbaNew2_adj_fdiv_m32i_adj_fdivr_m32i__vbaFreeStrList_adj_fdivr_m32_adj_fdiv_rNone_CIatan__vbaI4Cy_allmul_CItan_CIexpPEResources{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':321790,u'sha256':u'99663efee2758204e3cd58f3cbeb62c92b913abdc6656987467e2ea976fbed71',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1384}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':320662,u'sha256':u'a2631dedf7188fbf5640b36941d788d3fdbbb5996244b4891eb6c7313ea2596f',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1128}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_GROUP_ICON',u'offset':320628,u'sha256':u'6369848d3ee42be4460e6f4b9c8b003e2640e7e262220182de7d8f8c64cec290',u'type':u'MSWindowsiconresource-2icons,16x16',u'size':34}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_VERSION',u'offset':319776,u'sha256':u'80ff935a732d6447380ade43d114e62bf37b8cf8f0f192f0dd21bb55a372ed07',u'type':u'data',u'size':852}CERTIFICATEVALIDATION-CertificateValidationisnotApplicablePage13SCREENSHOTSPage14
- VarParseNumFromStrcomodo相关文档
- cmdmcomodo
- WayBillcomodo
- impactcomodo
- 丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂comodo
- 2011ArubaNetworksInc.
- Europeacomodo
Letbox(35美元/年),美国洛杉矶VPS终身7折
Letbox 云服务商在前面的文章中其实也有多次介绍，这个服务商其实也算是比较老牌的海外服务商，几年前我也一直有使用过他们家的VPS主机，早年那时候低至年付15-35美元左右的VPS算式比较稀缺的。后来由于服务商确实比较多，而且也没有太多的网站需要用到，所以就没有续费，最近这个服务商好像有点活动就躁动的发布希望引起他人注意。这不有看到所谓的家中有喜事，应该是团队中有生宝宝了，所以也有借此来发布一些...
SugarHosts新增Windows云服务器sugarhosts六折无限流量云服务器六折优惠
SugarHosts糖果主机商我们较早的站长们肯定是熟悉的，早年是提供虚拟主机起家的，如今一直还在提供虚拟主机，后来也有增加云服务器、独立服务器等。数据中心涵盖美国、德国、香港等。我们要知道大部分的海外主机商都只提供Linux系统云服务器。今天，糖果主机有新增SugarHosts夏季六折的优惠，以及新品Windows云服务器/云VPS上线。SugarHosts Windows系统云服务器有区分限制...
Ceranetworks顶级合作伙伴 香港E3 16G 299元 香港E5 32G 650元 美国E3 16G 650元
提速啦（www.tisula.com）是赣州王成璟网络科技有限公司旗下云服务器品牌，目前拥有在籍员工40人左右，社保在籍员工30人+，是正规的国内拥有IDC ICP ISP CDN 云牌照资质商家，2018-2021年连续4年获得CTG机房顶级金牌代理商荣誉 2021年赣州市于都县创业大赛三等奖，2020年于都电子商务示范企业，2021年于都县电子商务融合推广大使。资源优势介绍：Ceranetwo...
comodo为你推荐
-
云主机租用云服务器（云主机）租用一年多少钱域名价格什么样的域名比较值钱？虚拟主机价格谁知道租虚拟主机多少钱？独立ip空间如何设置独立IP加到现有空间域名空间代理现在代理域名空间赚钱吗linux主机linux主机有什么区别？求答案域名服务什么叫主域名服务器？空间域名空间域名什么意思国外主机空间2个国外主机空间，都放了BLOG，看看哪个更快？成都虚拟空间五星网络隶属于成都冠一科技有限公司，虚拟空间购买了不到一个月不能访问2次，质量真差啊！